Measure first

Before changing anything, look at what you're receiving. Are spam submissions mostly links, the same message repeated, nonsense text, or sales pitches typed by real people? Bots and human spammers need different defences, and protection that stops neither is just friction.

Layered defences, lightest first

1. Honeypot field

A field hidden from people but visible to simple bots. If it's filled in, the submission is discarded. Invisible to customers; stops a lot of basic spam. Make sure it's hidden properly so screen readers and autofill don't fill it.

2. Server-side validation

Check on the server, not just in the browser: email format, reasonable field lengths, required fields present. Reject submissions with many links in the message field if your customers never send links.

3. Rate limiting

Limit how many submissions one source can make in a short period. Stops floods without affecting normal customers.

4. A challenge service

If spam continues, add a challenge that runs mostly in the background:

Both involve third-party scripts, so mention them in your privacy notice and check any consent requirements where you operate. The challenge token must be verified on the server; a widget that's only checked in the browser can be bypassed.

The accessibility trade-off

Puzzle challenges — distorted text, image grids — can block people with visual, motor or cognitive disabilities. The W3C note on the inaccessibility of CAPTCHA explains the problems and alternatives. Prefer honeypots, server checks and low-friction challenges, and always keep a phone number or email address on the page as an alternative route.

Don't lose real leads

Spam filters make mistakes. Protect against false positives:

  • Store rejected submissions somewhere for a while, and check them occasionally.
  • Test the form from a phone on mobile data, a different browser and a VPN.
  • Test with a screen reader or keyboard only.
  • Watch for sudden drops in genuine enquiries after changing protection.
  • Make the error message helpful: tell people what to fix, or how else to reach you.

Human spam

Sales pitches typed by real people get past bot checks. Options: a short, required choice field ("What do you need help with?") that pitchers tend to skip or answer oddly, filtering rules in your inbox, and simply deleting them. Don't make the form harder for customers to stop a few sales emails.

If submissions are disappearing rather than being spammy, start with contact form not sending. For which fields to ask in the first place, see quote request form fields.

Questions

Is a CAPTCHA required?

No. Many small sites manage with a honeypot and server-side checks. Add a challenge such as Turnstile or reCAPTCHA if spam continues, and choose options that minimise friction for people.

Can spam protection hurt accessibility?

Yes. Visual or puzzle challenges can block people using screen readers or with cognitive disabilities. The W3C has documented these concerns; prefer low-friction or invisible checks.

Sources and further reading

Official documentation changes. Check the current version before you rely on a rule, limit or setting.

Next step

See a site built around your real details.

Look at sample layouts (fictional previews, not client work), read published website pricing, or ask for a free concept preview.

Get a website demoSee website pricing

Already happy with your site? Website Maintenance covers monitoring, a monthly form test, backups and edits.